Secure the Raspberry Pi

If you make the Raspberry Pi accessible via the internet then it must be properly secured.

SSH

We have already secured SSH access with keys, so access with a password is no longer desirable. Amend file /etc/ssh/sshd_config. It is a large file so let’s open the file from WinSCP with Notepad ++.
Make sure that the following lines are in the file:

Check: ChallengeResponseAuthentication no
#PasswordAuthentication yes change to: PasswordAuthentication no
Change UsePAM yes to: UsePAM no

After saving, the SSH service must be restarted: sudo service ssh restart
Now try to log in via user + password. That should be impossible. Do this for example via a new site in WinSCP.

Database

As a sudoer, you can log in to the database with the root user without a password. It might be better to secure the root user of the database with a password.

Login to the database with command: sudo mysql -u root
Type in the mysql prompt: use mysql;
Type:

UPDATE user
SET plugin = ‘’, authentication_string=PASSWORD(“< a strong password>”)
WHERE User=’root’;

Type: FLUSH privileges;

Close the mysql session with: quit
You can now no longer log in to mysql without a password.
You now have to login with: mysql -uroot -p
Note: no space between -p and the password!

Firewall

Install via command: sudo apt-get install ufw

Then set up the required ports
• sudo ufw allow ssh
• sudo ufw allow 80/tcp
• sudo ufw allow 443/tcp

If everything is configured then activate the firewall: sudo ufw enable
and check if everything is to your liking with: sudo ufw status

The configuration opens ports in the firewall. We must prevent undesirable behavior on these ports. We install fail2ban for that:
sudo apt-get install fail2ban

To activate the configuration copy:
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Then restart: sudo service fail2ban restart

Pi user

The pi-user exists on every Raspberry pi and can therefore not be used for safety reasons. Creating a sudo-user to replace the user pi is therefore a good idea.
Keep in mind that certain features of the Raspberry pi Desktop are hard-coded associated with the pi-user! After deactivating the pi-user, this will no longer work!
sudo useradd – groups sudo-m
sudo passwd
Enter a password for the new user.
If you want to be able to run sudo without a password with , you must place a file in /etc/sudoers.d. Take file 010_pi-nopasswd as an example.
Copy /home/pi/.ssh/authorizeds_keys to the corresponding location of the and adjust owner and group to the new user.
Finally: sudo passwd –lock pi
You can no longer log in with the pi-user. Also remove /home/pi/.ssh

Automate updates of the software

Install: apt-get install unattended upgrades
Add the lines below to the “Unattended-Upgrade :: Origins-Pattern” section in file /etc/apt/apt.conf.d/50unattendedupgrades.

"origin = Raspbian, codename = $ {distro_codename}, label = Raspbian";
 "origin = Raspberry Pi Foundation, codename = $ {distro_codename}, label = Raspberry Pi Foundation";

Normally there is no reboot, even if desireable. You can change the automatic reboot rule:
// Unattended-Upgrade :: Automatic-Reboot “false”;
to
Unattended-Upgrade :: Automatic-Reboot “true”;

Previous page Next page